CVE-2026-11452: GL.iNet GL-MT3000 Command Injection Vulnerability – Firmware Update Required

Technical summary

The vulnerability exists in function FUN_0042e200 within the SET_USER_PWD handler of /cgi-bin/glc. The root cause is improper sanitization of the Password parameter before passing it to a shell execution context. While the affected firmware versions attempted to escape single quotes, they failed to prevent other shell metacharacters (such as command substitution operators) from being interpreted. An unauthenticated remote attacker can inject arbitrary shell commands by crafting payloads that leverage command substitution syntax, allowing code execution with the privileges of the web server process. The fix in version 4.8.1 implements comprehensive escaping and uses a shell single-quote context that safely isolates user input.

Business impact

Compromise of GL-MT3000 routers could lead to complete device takeover, allowing attackers to intercept network traffic, modify routing rules, conduct man-in-the-middle attacks, or use the device as a pivot point into downstream networks. For small businesses and home office environments relying on these devices, unauthorized access could result in data theft, credential harvesting, and lateral movement into connected systems. The remote, unauthenticated nature of the attack means no prior access or user interaction is required, increasing the attack surface significantly.

Affected systems

GL.iNet GL-MT3000 devices running firmware versions 4.4.5 and earlier are vulnerable. The vulnerability affects all instances accessible over a network unless protected by external firewall rules. Devices that have been updated to firmware version 4.8.1 or later are not affected.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and can be triggered over the network. The attack complexity is low—an attacker need only send an HTTP request to the affected CGI handler with a malicious password parameter. The payloads do not require specialized timing or race conditions. Exploitation would allow an attacker to execute arbitrary commands on the router with web server privileges, which typically run as root or a high-privilege system user on embedded devices.

Remediation

Immediately upgrade GL-MT3000 firmware to version 4.8.1 or later. Verify the upgrade by checking the device's firmware version in the web interface or CLI. If immediate upgrading is not feasible, restrict network access to the /cgi-bin/glc endpoint using firewall rules on upstream network devices. Consider disabling remote management features if not actively required. After patching, audit device logs for signs of prior exploitation.

Patch guidance

Download the latest firmware from GL.iNet's official support portal and follow their documented upgrade procedure. Ensure the device remains powered on and connected during the update. Verify successful installation by confirming the firmware version matches 4.8.1 or a later release. Test basic connectivity and user authentication after the update to confirm proper operation. For organizations managing multiple GL-MT3000 devices, consider scheduling updates during a maintenance window to avoid service disruption.

Detection guidance

Monitor web server access logs on GL-MT3000 devices for unusual POST requests to /cgi-bin/glc with the SET_USER_PWD parameter containing special characters, command substitution operators ($(), backticks), or shell metacharacters. Intrusion detection systems should flag attempts to access this endpoint with payloads containing command injection patterns. Network-based detection can identify attempts using YARA rules or IDS signatures matching command injection syntax in HTTP parameters. File integrity monitoring on the device itself could alert to unexpected command execution or file creation by the web server process.

Why prioritize this

This vulnerability merits immediate remediation due to its combination of high CVSS score (7.3), unauthenticated remote exploitability, and low attack complexity. The lack of barriers to exploitation and the device's role as a network access point make it an attractive target for attackers seeking persistent network presence. Organizations should treat this as a priority patch candidate.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects a remotely exploitable vulnerability with no authentication required (AV:N, PR:N), low attack complexity (AC:L), and potential impact to confidentiality, integrity, and availability (C:L, I:L, A:L). The score appropriately captures that while direct availability impact may be partial, full device compromise enables broad attacks on connected networks. The absence of the vulnerability from CISA's KEV catalog at the time of publication does not diminish its severity—it indicates either recent discovery or limited current exploitation, not reduced risk.

Frequently asked questions